xref: /openbmc/qemu/hw/intc/openpic.c (revision acb0ef58)
1 /*
2  * OpenPIC emulation
3  *
4  * Copyright (c) 2004 Jocelyn Mayer
5  *               2011 Alexander Graf
6  *
7  * Permission is hereby granted, free of charge, to any person obtaining a copy
8  * of this software and associated documentation files (the "Software"), to deal
9  * in the Software without restriction, including without limitation the rights
10  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
11  * copies of the Software, and to permit persons to whom the Software is
12  * furnished to do so, subject to the following conditions:
13  *
14  * The above copyright notice and this permission notice shall be included in
15  * all copies or substantial portions of the Software.
16  *
17  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
18  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
19  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
20  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
21  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
22  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
23  * THE SOFTWARE.
24  */
25 /*
26  *
27  * Based on OpenPic implementations:
28  * - Intel GW80314 I/O companion chip developer's manual
29  * - Motorola MPC8245 & MPC8540 user manuals.
30  * - Motorola MCP750 (aka Raven) programmer manual.
31  * - Motorola Harrier programmer manuel
32  *
33  * Serial interrupts, as implemented in Raven chipset are not supported yet.
34  *
35  */
36 #include "hw/hw.h"
37 #include "hw/ppc/mac.h"
38 #include "hw/pci/pci.h"
39 #include "hw/ppc/openpic.h"
40 #include "hw/ppc/ppc_e500.h"
41 #include "hw/sysbus.h"
42 #include "hw/pci/msi.h"
43 #include "qemu/bitops.h"
44 #include "qapi/qmp/qerror.h"
45 
46 //#define DEBUG_OPENPIC
47 
48 #ifdef DEBUG_OPENPIC
49 static const int debug_openpic = 1;
50 #else
51 static const int debug_openpic = 0;
52 #endif
53 
54 #define DPRINTF(fmt, ...) do { \
55         if (debug_openpic) { \
56             printf(fmt , ## __VA_ARGS__); \
57         } \
58     } while (0)
59 
60 #define MAX_CPU     32
61 #define MAX_MSI     8
62 #define VID         0x03 /* MPIC version ID */
63 
64 /* OpenPIC capability flags */
65 #define OPENPIC_FLAG_IDR_CRIT     (1 << 0)
66 #define OPENPIC_FLAG_ILR          (2 << 0)
67 
68 /* OpenPIC address map */
69 #define OPENPIC_GLB_REG_START        0x0
70 #define OPENPIC_GLB_REG_SIZE         0x10F0
71 #define OPENPIC_TMR_REG_START        0x10F0
72 #define OPENPIC_TMR_REG_SIZE         0x220
73 #define OPENPIC_MSI_REG_START        0x1600
74 #define OPENPIC_MSI_REG_SIZE         0x200
75 #define OPENPIC_SUMMARY_REG_START   0x3800
76 #define OPENPIC_SUMMARY_REG_SIZE    0x800
77 #define OPENPIC_SRC_REG_START        0x10000
78 #define OPENPIC_SRC_REG_SIZE         (OPENPIC_MAX_SRC * 0x20)
79 #define OPENPIC_CPU_REG_START        0x20000
80 #define OPENPIC_CPU_REG_SIZE         0x100 + ((MAX_CPU - 1) * 0x1000)
81 
82 /* Raven */
83 #define RAVEN_MAX_CPU      2
84 #define RAVEN_MAX_EXT     48
85 #define RAVEN_MAX_IRQ     64
86 #define RAVEN_MAX_TMR      OPENPIC_MAX_TMR
87 #define RAVEN_MAX_IPI      OPENPIC_MAX_IPI
88 
89 /* Interrupt definitions */
90 #define RAVEN_FE_IRQ     (RAVEN_MAX_EXT)     /* Internal functional IRQ */
91 #define RAVEN_ERR_IRQ    (RAVEN_MAX_EXT + 1) /* Error IRQ */
92 #define RAVEN_TMR_IRQ    (RAVEN_MAX_EXT + 2) /* First timer IRQ */
93 #define RAVEN_IPI_IRQ    (RAVEN_TMR_IRQ + RAVEN_MAX_TMR) /* First IPI IRQ */
94 /* First doorbell IRQ */
95 #define RAVEN_DBL_IRQ    (RAVEN_IPI_IRQ + (RAVEN_MAX_CPU * RAVEN_MAX_IPI))
96 
97 typedef struct FslMpicInfo {
98     int max_ext;
99 } FslMpicInfo;
100 
101 static FslMpicInfo fsl_mpic_20 = {
102     .max_ext = 12,
103 };
104 
105 static FslMpicInfo fsl_mpic_42 = {
106     .max_ext = 12,
107 };
108 
109 #define FRR_NIRQ_SHIFT    16
110 #define FRR_NCPU_SHIFT     8
111 #define FRR_VID_SHIFT      0
112 
113 #define VID_REVISION_1_2   2
114 #define VID_REVISION_1_3   3
115 
116 #define VIR_GENERIC      0x00000000 /* Generic Vendor ID */
117 
118 #define GCR_RESET        0x80000000
119 #define GCR_MODE_PASS    0x00000000
120 #define GCR_MODE_MIXED   0x20000000
121 #define GCR_MODE_PROXY   0x60000000
122 
123 #define TBCR_CI           0x80000000 /* count inhibit */
124 #define TCCR_TOG          0x80000000 /* toggles when decrement to zero */
125 
126 #define IDR_EP_SHIFT      31
127 #define IDR_EP_MASK       (1U << IDR_EP_SHIFT)
128 #define IDR_CI0_SHIFT     30
129 #define IDR_CI1_SHIFT     29
130 #define IDR_P1_SHIFT      1
131 #define IDR_P0_SHIFT      0
132 
133 #define ILR_INTTGT_MASK   0x000000ff
134 #define ILR_INTTGT_INT    0x00
135 #define ILR_INTTGT_CINT   0x01 /* critical */
136 #define ILR_INTTGT_MCP    0x02 /* machine check */
137 
138 /* The currently supported INTTGT values happen to be the same as QEMU's
139  * openpic output codes, but don't depend on this.  The output codes
140  * could change (unlikely, but...) or support could be added for
141  * more INTTGT values.
142  */
143 static const int inttgt_output[][2] = {
144     { ILR_INTTGT_INT, OPENPIC_OUTPUT_INT },
145     { ILR_INTTGT_CINT, OPENPIC_OUTPUT_CINT },
146     { ILR_INTTGT_MCP, OPENPIC_OUTPUT_MCK },
147 };
148 
149 static int inttgt_to_output(int inttgt)
150 {
151     int i;
152 
153     for (i = 0; i < ARRAY_SIZE(inttgt_output); i++) {
154         if (inttgt_output[i][0] == inttgt) {
155             return inttgt_output[i][1];
156         }
157     }
158 
159     fprintf(stderr, "%s: unsupported inttgt %d\n", __func__, inttgt);
160     return OPENPIC_OUTPUT_INT;
161 }
162 
163 static int output_to_inttgt(int output)
164 {
165     int i;
166 
167     for (i = 0; i < ARRAY_SIZE(inttgt_output); i++) {
168         if (inttgt_output[i][1] == output) {
169             return inttgt_output[i][0];
170         }
171     }
172 
173     abort();
174 }
175 
176 #define MSIIR_OFFSET       0x140
177 #define MSIIR_SRS_SHIFT    29
178 #define MSIIR_SRS_MASK     (0x7 << MSIIR_SRS_SHIFT)
179 #define MSIIR_IBS_SHIFT    24
180 #define MSIIR_IBS_MASK     (0x1f << MSIIR_IBS_SHIFT)
181 
182 static int get_current_cpu(void)
183 {
184     if (!current_cpu) {
185         return -1;
186     }
187 
188     return current_cpu->cpu_index;
189 }
190 
191 static uint32_t openpic_cpu_read_internal(void *opaque, hwaddr addr,
192                                           int idx);
193 static void openpic_cpu_write_internal(void *opaque, hwaddr addr,
194                                        uint32_t val, int idx);
195 
196 typedef enum IRQType {
197     IRQ_TYPE_NORMAL = 0,
198     IRQ_TYPE_FSLINT,        /* FSL internal interrupt -- level only */
199     IRQ_TYPE_FSLSPECIAL,    /* FSL timer/IPI interrupt, edge, no polarity */
200 } IRQType;
201 
202 typedef struct IRQQueue {
203     /* Round up to the nearest 64 IRQs so that the queue length
204      * won't change when moving between 32 and 64 bit hosts.
205      */
206     unsigned long queue[BITS_TO_LONGS((OPENPIC_MAX_IRQ + 63) & ~63)];
207     int next;
208     int priority;
209 } IRQQueue;
210 
211 typedef struct IRQSource {
212     uint32_t ivpr;  /* IRQ vector/priority register */
213     uint32_t idr;   /* IRQ destination register */
214     uint32_t destmask; /* bitmap of CPU destinations */
215     int last_cpu;
216     int output;     /* IRQ level, e.g. OPENPIC_OUTPUT_INT */
217     int pending;    /* TRUE if IRQ is pending */
218     IRQType type;
219     bool level:1;   /* level-triggered */
220     bool nomask:1;  /* critical interrupts ignore mask on some FSL MPICs */
221 } IRQSource;
222 
223 #define IVPR_MASK_SHIFT       31
224 #define IVPR_MASK_MASK        (1U << IVPR_MASK_SHIFT)
225 #define IVPR_ACTIVITY_SHIFT   30
226 #define IVPR_ACTIVITY_MASK    (1U << IVPR_ACTIVITY_SHIFT)
227 #define IVPR_MODE_SHIFT       29
228 #define IVPR_MODE_MASK        (1U << IVPR_MODE_SHIFT)
229 #define IVPR_POLARITY_SHIFT   23
230 #define IVPR_POLARITY_MASK    (1U << IVPR_POLARITY_SHIFT)
231 #define IVPR_SENSE_SHIFT      22
232 #define IVPR_SENSE_MASK       (1U << IVPR_SENSE_SHIFT)
233 
234 #define IVPR_PRIORITY_MASK     (0xFU << 16)
235 #define IVPR_PRIORITY(_ivprr_) ((int)(((_ivprr_) & IVPR_PRIORITY_MASK) >> 16))
236 #define IVPR_VECTOR(opp, _ivprr_) ((_ivprr_) & (opp)->vector_mask)
237 
238 /* IDR[EP/CI] are only for FSL MPIC prior to v4.0 */
239 #define IDR_EP      0x80000000  /* external pin */
240 #define IDR_CI      0x40000000  /* critical interrupt */
241 
242 typedef struct IRQDest {
243     int32_t ctpr; /* CPU current task priority */
244     IRQQueue raised;
245     IRQQueue servicing;
246     qemu_irq *irqs;
247 
248     /* Count of IRQ sources asserting on non-INT outputs */
249     uint32_t outputs_active[OPENPIC_OUTPUT_NB];
250 } IRQDest;
251 
252 #define OPENPIC(obj) OBJECT_CHECK(OpenPICState, (obj), TYPE_OPENPIC)
253 
254 typedef struct OpenPICState {
255     /*< private >*/
256     SysBusDevice parent_obj;
257     /*< public >*/
258 
259     MemoryRegion mem;
260 
261     /* Behavior control */
262     FslMpicInfo *fsl;
263     uint32_t model;
264     uint32_t flags;
265     uint32_t nb_irqs;
266     uint32_t vid;
267     uint32_t vir; /* Vendor identification register */
268     uint32_t vector_mask;
269     uint32_t tfrr_reset;
270     uint32_t ivpr_reset;
271     uint32_t idr_reset;
272     uint32_t brr1;
273     uint32_t mpic_mode_mask;
274 
275     /* Sub-regions */
276     MemoryRegion sub_io_mem[6];
277 
278     /* Global registers */
279     uint32_t frr; /* Feature reporting register */
280     uint32_t gcr; /* Global configuration register  */
281     uint32_t pir; /* Processor initialization register */
282     uint32_t spve; /* Spurious vector register */
283     uint32_t tfrr; /* Timer frequency reporting register */
284     /* Source registers */
285     IRQSource src[OPENPIC_MAX_IRQ];
286     /* Local registers per output pin */
287     IRQDest dst[MAX_CPU];
288     uint32_t nb_cpus;
289     /* Timer registers */
290     struct {
291         uint32_t tccr;  /* Global timer current count register */
292         uint32_t tbcr;  /* Global timer base count register */
293     } timers[OPENPIC_MAX_TMR];
294     /* Shared MSI registers */
295     struct {
296         uint32_t msir;   /* Shared Message Signaled Interrupt Register */
297     } msi[MAX_MSI];
298     uint32_t max_irq;
299     uint32_t irq_ipi0;
300     uint32_t irq_tim0;
301     uint32_t irq_msi;
302 } OpenPICState;
303 
304 static inline void IRQ_setbit(IRQQueue *q, int n_IRQ)
305 {
306     set_bit(n_IRQ, q->queue);
307 }
308 
309 static inline void IRQ_resetbit(IRQQueue *q, int n_IRQ)
310 {
311     clear_bit(n_IRQ, q->queue);
312 }
313 
314 static void IRQ_check(OpenPICState *opp, IRQQueue *q)
315 {
316     int irq = -1;
317     int next = -1;
318     int priority = -1;
319 
320     for (;;) {
321         irq = find_next_bit(q->queue, opp->max_irq, irq + 1);
322         if (irq == opp->max_irq) {
323             break;
324         }
325 
326         DPRINTF("IRQ_check: irq %d set ivpr_pr=%d pr=%d\n",
327                 irq, IVPR_PRIORITY(opp->src[irq].ivpr), priority);
328 
329         if (IVPR_PRIORITY(opp->src[irq].ivpr) > priority) {
330             next = irq;
331             priority = IVPR_PRIORITY(opp->src[irq].ivpr);
332         }
333     }
334 
335     q->next = next;
336     q->priority = priority;
337 }
338 
339 static int IRQ_get_next(OpenPICState *opp, IRQQueue *q)
340 {
341     /* XXX: optimize */
342     IRQ_check(opp, q);
343 
344     return q->next;
345 }
346 
347 static void IRQ_local_pipe(OpenPICState *opp, int n_CPU, int n_IRQ,
348                            bool active, bool was_active)
349 {
350     IRQDest *dst;
351     IRQSource *src;
352     int priority;
353 
354     dst = &opp->dst[n_CPU];
355     src = &opp->src[n_IRQ];
356 
357     DPRINTF("%s: IRQ %d active %d was %d\n",
358             __func__, n_IRQ, active, was_active);
359 
360     if (src->output != OPENPIC_OUTPUT_INT) {
361         DPRINTF("%s: output %d irq %d active %d was %d count %d\n",
362                 __func__, src->output, n_IRQ, active, was_active,
363                 dst->outputs_active[src->output]);
364 
365         /* On Freescale MPIC, critical interrupts ignore priority,
366          * IACK, EOI, etc.  Before MPIC v4.1 they also ignore
367          * masking.
368          */
369         if (active) {
370             if (!was_active && dst->outputs_active[src->output]++ == 0) {
371                 DPRINTF("%s: Raise OpenPIC output %d cpu %d irq %d\n",
372                         __func__, src->output, n_CPU, n_IRQ);
373                 qemu_irq_raise(dst->irqs[src->output]);
374             }
375         } else {
376             if (was_active && --dst->outputs_active[src->output] == 0) {
377                 DPRINTF("%s: Lower OpenPIC output %d cpu %d irq %d\n",
378                         __func__, src->output, n_CPU, n_IRQ);
379                 qemu_irq_lower(dst->irqs[src->output]);
380             }
381         }
382 
383         return;
384     }
385 
386     priority = IVPR_PRIORITY(src->ivpr);
387 
388     /* Even if the interrupt doesn't have enough priority,
389      * it is still raised, in case ctpr is lowered later.
390      */
391     if (active) {
392         IRQ_setbit(&dst->raised, n_IRQ);
393     } else {
394         IRQ_resetbit(&dst->raised, n_IRQ);
395     }
396 
397     IRQ_check(opp, &dst->raised);
398 
399     if (active && priority <= dst->ctpr) {
400         DPRINTF("%s: IRQ %d priority %d too low for ctpr %d on CPU %d\n",
401                 __func__, n_IRQ, priority, dst->ctpr, n_CPU);
402         active = 0;
403     }
404 
405     if (active) {
406         if (IRQ_get_next(opp, &dst->servicing) >= 0 &&
407                 priority <= dst->servicing.priority) {
408             DPRINTF("%s: IRQ %d is hidden by servicing IRQ %d on CPU %d\n",
409                     __func__, n_IRQ, dst->servicing.next, n_CPU);
410         } else {
411             DPRINTF("%s: Raise OpenPIC INT output cpu %d irq %d/%d\n",
412                     __func__, n_CPU, n_IRQ, dst->raised.next);
413             qemu_irq_raise(opp->dst[n_CPU].irqs[OPENPIC_OUTPUT_INT]);
414         }
415     } else {
416         IRQ_get_next(opp, &dst->servicing);
417         if (dst->raised.priority > dst->ctpr &&
418                 dst->raised.priority > dst->servicing.priority) {
419             DPRINTF("%s: IRQ %d inactive, IRQ %d prio %d above %d/%d, CPU %d\n",
420                     __func__, n_IRQ, dst->raised.next, dst->raised.priority,
421                     dst->ctpr, dst->servicing.priority, n_CPU);
422             /* IRQ line stays asserted */
423         } else {
424             DPRINTF("%s: IRQ %d inactive, current prio %d/%d, CPU %d\n",
425                     __func__, n_IRQ, dst->ctpr, dst->servicing.priority, n_CPU);
426             qemu_irq_lower(opp->dst[n_CPU].irqs[OPENPIC_OUTPUT_INT]);
427         }
428     }
429 }
430 
431 /* update pic state because registers for n_IRQ have changed value */
432 static void openpic_update_irq(OpenPICState *opp, int n_IRQ)
433 {
434     IRQSource *src;
435     bool active, was_active;
436     int i;
437 
438     src = &opp->src[n_IRQ];
439     active = src->pending;
440 
441     if ((src->ivpr & IVPR_MASK_MASK) && !src->nomask) {
442         /* Interrupt source is disabled */
443         DPRINTF("%s: IRQ %d is disabled\n", __func__, n_IRQ);
444         active = false;
445     }
446 
447     was_active = !!(src->ivpr & IVPR_ACTIVITY_MASK);
448 
449     /*
450      * We don't have a similar check for already-active because
451      * ctpr may have changed and we need to withdraw the interrupt.
452      */
453     if (!active && !was_active) {
454         DPRINTF("%s: IRQ %d is already inactive\n", __func__, n_IRQ);
455         return;
456     }
457 
458     if (active) {
459         src->ivpr |= IVPR_ACTIVITY_MASK;
460     } else {
461         src->ivpr &= ~IVPR_ACTIVITY_MASK;
462     }
463 
464     if (src->destmask == 0) {
465         /* No target */
466         DPRINTF("%s: IRQ %d has no target\n", __func__, n_IRQ);
467         return;
468     }
469 
470     if (src->destmask == (1 << src->last_cpu)) {
471         /* Only one CPU is allowed to receive this IRQ */
472         IRQ_local_pipe(opp, src->last_cpu, n_IRQ, active, was_active);
473     } else if (!(src->ivpr & IVPR_MODE_MASK)) {
474         /* Directed delivery mode */
475         for (i = 0; i < opp->nb_cpus; i++) {
476             if (src->destmask & (1 << i)) {
477                 IRQ_local_pipe(opp, i, n_IRQ, active, was_active);
478             }
479         }
480     } else {
481         /* Distributed delivery mode */
482         for (i = src->last_cpu + 1; i != src->last_cpu; i++) {
483             if (i == opp->nb_cpus) {
484                 i = 0;
485             }
486             if (src->destmask & (1 << i)) {
487                 IRQ_local_pipe(opp, i, n_IRQ, active, was_active);
488                 src->last_cpu = i;
489                 break;
490             }
491         }
492     }
493 }
494 
495 static void openpic_set_irq(void *opaque, int n_IRQ, int level)
496 {
497     OpenPICState *opp = opaque;
498     IRQSource *src;
499 
500     if (n_IRQ >= OPENPIC_MAX_IRQ) {
501         fprintf(stderr, "%s: IRQ %d out of range\n", __func__, n_IRQ);
502         abort();
503     }
504 
505     src = &opp->src[n_IRQ];
506     DPRINTF("openpic: set irq %d = %d ivpr=0x%08x\n",
507             n_IRQ, level, src->ivpr);
508     if (src->level) {
509         /* level-sensitive irq */
510         src->pending = level;
511         openpic_update_irq(opp, n_IRQ);
512     } else {
513         /* edge-sensitive irq */
514         if (level) {
515             src->pending = 1;
516             openpic_update_irq(opp, n_IRQ);
517         }
518 
519         if (src->output != OPENPIC_OUTPUT_INT) {
520             /* Edge-triggered interrupts shouldn't be used
521              * with non-INT delivery, but just in case,
522              * try to make it do something sane rather than
523              * cause an interrupt storm.  This is close to
524              * what you'd probably see happen in real hardware.
525              */
526             src->pending = 0;
527             openpic_update_irq(opp, n_IRQ);
528         }
529     }
530 }
531 
532 static void openpic_reset(DeviceState *d)
533 {
534     OpenPICState *opp = OPENPIC(d);
535     int i;
536 
537     opp->gcr = GCR_RESET;
538     /* Initialise controller registers */
539     opp->frr = ((opp->nb_irqs - 1) << FRR_NIRQ_SHIFT) |
540                ((opp->nb_cpus - 1) << FRR_NCPU_SHIFT) |
541                (opp->vid << FRR_VID_SHIFT);
542 
543     opp->pir = 0;
544     opp->spve = -1 & opp->vector_mask;
545     opp->tfrr = opp->tfrr_reset;
546     /* Initialise IRQ sources */
547     for (i = 0; i < opp->max_irq; i++) {
548         opp->src[i].ivpr = opp->ivpr_reset;
549         opp->src[i].idr  = opp->idr_reset;
550 
551         switch (opp->src[i].type) {
552         case IRQ_TYPE_NORMAL:
553             opp->src[i].level = !!(opp->ivpr_reset & IVPR_SENSE_MASK);
554             break;
555 
556         case IRQ_TYPE_FSLINT:
557             opp->src[i].ivpr |= IVPR_POLARITY_MASK;
558             break;
559 
560         case IRQ_TYPE_FSLSPECIAL:
561             break;
562         }
563     }
564     /* Initialise IRQ destinations */
565     for (i = 0; i < MAX_CPU; i++) {
566         opp->dst[i].ctpr      = 15;
567         memset(&opp->dst[i].raised, 0, sizeof(IRQQueue));
568         opp->dst[i].raised.next = -1;
569         memset(&opp->dst[i].servicing, 0, sizeof(IRQQueue));
570         opp->dst[i].servicing.next = -1;
571     }
572     /* Initialise timers */
573     for (i = 0; i < OPENPIC_MAX_TMR; i++) {
574         opp->timers[i].tccr = 0;
575         opp->timers[i].tbcr = TBCR_CI;
576     }
577     /* Go out of RESET state */
578     opp->gcr = 0;
579 }
580 
581 static inline uint32_t read_IRQreg_idr(OpenPICState *opp, int n_IRQ)
582 {
583     return opp->src[n_IRQ].idr;
584 }
585 
586 static inline uint32_t read_IRQreg_ilr(OpenPICState *opp, int n_IRQ)
587 {
588     if (opp->flags & OPENPIC_FLAG_ILR) {
589         return output_to_inttgt(opp->src[n_IRQ].output);
590     }
591 
592     return 0xffffffff;
593 }
594 
595 static inline uint32_t read_IRQreg_ivpr(OpenPICState *opp, int n_IRQ)
596 {
597     return opp->src[n_IRQ].ivpr;
598 }
599 
600 static inline void write_IRQreg_idr(OpenPICState *opp, int n_IRQ, uint32_t val)
601 {
602     IRQSource *src = &opp->src[n_IRQ];
603     uint32_t normal_mask = (1UL << opp->nb_cpus) - 1;
604     uint32_t crit_mask = 0;
605     uint32_t mask = normal_mask;
606     int crit_shift = IDR_EP_SHIFT - opp->nb_cpus;
607     int i;
608 
609     if (opp->flags & OPENPIC_FLAG_IDR_CRIT) {
610         crit_mask = mask << crit_shift;
611         mask |= crit_mask | IDR_EP;
612     }
613 
614     src->idr = val & mask;
615     DPRINTF("Set IDR %d to 0x%08x\n", n_IRQ, src->idr);
616 
617     if (opp->flags & OPENPIC_FLAG_IDR_CRIT) {
618         if (src->idr & crit_mask) {
619             if (src->idr & normal_mask) {
620                 DPRINTF("%s: IRQ configured for multiple output types, using "
621                         "critical\n", __func__);
622             }
623 
624             src->output = OPENPIC_OUTPUT_CINT;
625             src->nomask = true;
626             src->destmask = 0;
627 
628             for (i = 0; i < opp->nb_cpus; i++) {
629                 int n_ci = IDR_CI0_SHIFT - i;
630 
631                 if (src->idr & (1UL << n_ci)) {
632                     src->destmask |= 1UL << i;
633                 }
634             }
635         } else {
636             src->output = OPENPIC_OUTPUT_INT;
637             src->nomask = false;
638             src->destmask = src->idr & normal_mask;
639         }
640     } else {
641         src->destmask = src->idr;
642     }
643 }
644 
645 static inline void write_IRQreg_ilr(OpenPICState *opp, int n_IRQ, uint32_t val)
646 {
647     if (opp->flags & OPENPIC_FLAG_ILR) {
648         IRQSource *src = &opp->src[n_IRQ];
649 
650         src->output = inttgt_to_output(val & ILR_INTTGT_MASK);
651         DPRINTF("Set ILR %d to 0x%08x, output %d\n", n_IRQ, src->idr,
652                 src->output);
653 
654         /* TODO: on MPIC v4.0 only, set nomask for non-INT */
655     }
656 }
657 
658 static inline void write_IRQreg_ivpr(OpenPICState *opp, int n_IRQ, uint32_t val)
659 {
660     uint32_t mask;
661 
662     /* NOTE when implementing newer FSL MPIC models: starting with v4.0,
663      * the polarity bit is read-only on internal interrupts.
664      */
665     mask = IVPR_MASK_MASK | IVPR_PRIORITY_MASK | IVPR_SENSE_MASK |
666            IVPR_POLARITY_MASK | opp->vector_mask;
667 
668     /* ACTIVITY bit is read-only */
669     opp->src[n_IRQ].ivpr =
670         (opp->src[n_IRQ].ivpr & IVPR_ACTIVITY_MASK) | (val & mask);
671 
672     /* For FSL internal interrupts, The sense bit is reserved and zero,
673      * and the interrupt is always level-triggered.  Timers and IPIs
674      * have no sense or polarity bits, and are edge-triggered.
675      */
676     switch (opp->src[n_IRQ].type) {
677     case IRQ_TYPE_NORMAL:
678         opp->src[n_IRQ].level = !!(opp->src[n_IRQ].ivpr & IVPR_SENSE_MASK);
679         break;
680 
681     case IRQ_TYPE_FSLINT:
682         opp->src[n_IRQ].ivpr &= ~IVPR_SENSE_MASK;
683         break;
684 
685     case IRQ_TYPE_FSLSPECIAL:
686         opp->src[n_IRQ].ivpr &= ~(IVPR_POLARITY_MASK | IVPR_SENSE_MASK);
687         break;
688     }
689 
690     openpic_update_irq(opp, n_IRQ);
691     DPRINTF("Set IVPR %d to 0x%08x -> 0x%08x\n", n_IRQ, val,
692             opp->src[n_IRQ].ivpr);
693 }
694 
695 static void openpic_gcr_write(OpenPICState *opp, uint64_t val)
696 {
697     bool mpic_proxy = false;
698 
699     if (val & GCR_RESET) {
700         openpic_reset(DEVICE(opp));
701         return;
702     }
703 
704     opp->gcr &= ~opp->mpic_mode_mask;
705     opp->gcr |= val & opp->mpic_mode_mask;
706 
707     /* Set external proxy mode */
708     if ((val & opp->mpic_mode_mask) == GCR_MODE_PROXY) {
709         mpic_proxy = true;
710     }
711 
712     ppce500_set_mpic_proxy(mpic_proxy);
713 }
714 
715 static void openpic_gbl_write(void *opaque, hwaddr addr, uint64_t val,
716                               unsigned len)
717 {
718     OpenPICState *opp = opaque;
719     IRQDest *dst;
720     int idx;
721 
722     DPRINTF("%s: addr %#" HWADDR_PRIx " <= %08" PRIx64 "\n",
723             __func__, addr, val);
724     if (addr & 0xF) {
725         return;
726     }
727     switch (addr) {
728     case 0x00: /* Block Revision Register1 (BRR1) is Readonly */
729         break;
730     case 0x40:
731     case 0x50:
732     case 0x60:
733     case 0x70:
734     case 0x80:
735     case 0x90:
736     case 0xA0:
737     case 0xB0:
738         openpic_cpu_write_internal(opp, addr, val, get_current_cpu());
739         break;
740     case 0x1000: /* FRR */
741         break;
742     case 0x1020: /* GCR */
743         openpic_gcr_write(opp, val);
744         break;
745     case 0x1080: /* VIR */
746         break;
747     case 0x1090: /* PIR */
748         for (idx = 0; idx < opp->nb_cpus; idx++) {
749             if ((val & (1 << idx)) && !(opp->pir & (1 << idx))) {
750                 DPRINTF("Raise OpenPIC RESET output for CPU %d\n", idx);
751                 dst = &opp->dst[idx];
752                 qemu_irq_raise(dst->irqs[OPENPIC_OUTPUT_RESET]);
753             } else if (!(val & (1 << idx)) && (opp->pir & (1 << idx))) {
754                 DPRINTF("Lower OpenPIC RESET output for CPU %d\n", idx);
755                 dst = &opp->dst[idx];
756                 qemu_irq_lower(dst->irqs[OPENPIC_OUTPUT_RESET]);
757             }
758         }
759         opp->pir = val;
760         break;
761     case 0x10A0: /* IPI_IVPR */
762     case 0x10B0:
763     case 0x10C0:
764     case 0x10D0:
765         {
766             int idx;
767             idx = (addr - 0x10A0) >> 4;
768             write_IRQreg_ivpr(opp, opp->irq_ipi0 + idx, val);
769         }
770         break;
771     case 0x10E0: /* SPVE */
772         opp->spve = val & opp->vector_mask;
773         break;
774     default:
775         break;
776     }
777 }
778 
779 static uint64_t openpic_gbl_read(void *opaque, hwaddr addr, unsigned len)
780 {
781     OpenPICState *opp = opaque;
782     uint32_t retval;
783 
784     DPRINTF("%s: addr %#" HWADDR_PRIx "\n", __func__, addr);
785     retval = 0xFFFFFFFF;
786     if (addr & 0xF) {
787         return retval;
788     }
789     switch (addr) {
790     case 0x1000: /* FRR */
791         retval = opp->frr;
792         break;
793     case 0x1020: /* GCR */
794         retval = opp->gcr;
795         break;
796     case 0x1080: /* VIR */
797         retval = opp->vir;
798         break;
799     case 0x1090: /* PIR */
800         retval = 0x00000000;
801         break;
802     case 0x00: /* Block Revision Register1 (BRR1) */
803         retval = opp->brr1;
804         break;
805     case 0x40:
806     case 0x50:
807     case 0x60:
808     case 0x70:
809     case 0x80:
810     case 0x90:
811     case 0xA0:
812     case 0xB0:
813         retval = openpic_cpu_read_internal(opp, addr, get_current_cpu());
814         break;
815     case 0x10A0: /* IPI_IVPR */
816     case 0x10B0:
817     case 0x10C0:
818     case 0x10D0:
819         {
820             int idx;
821             idx = (addr - 0x10A0) >> 4;
822             retval = read_IRQreg_ivpr(opp, opp->irq_ipi0 + idx);
823         }
824         break;
825     case 0x10E0: /* SPVE */
826         retval = opp->spve;
827         break;
828     default:
829         break;
830     }
831     DPRINTF("%s: => 0x%08x\n", __func__, retval);
832 
833     return retval;
834 }
835 
836 static void openpic_tmr_write(void *opaque, hwaddr addr, uint64_t val,
837                                 unsigned len)
838 {
839     OpenPICState *opp = opaque;
840     int idx;
841 
842     addr += 0x10f0;
843 
844     DPRINTF("%s: addr %#" HWADDR_PRIx " <= %08" PRIx64 "\n",
845             __func__, addr, val);
846     if (addr & 0xF) {
847         return;
848     }
849 
850     if (addr == 0x10f0) {
851         /* TFRR */
852         opp->tfrr = val;
853         return;
854     }
855 
856     idx = (addr >> 6) & 0x3;
857     addr = addr & 0x30;
858 
859     switch (addr & 0x30) {
860     case 0x00: /* TCCR */
861         break;
862     case 0x10: /* TBCR */
863         if ((opp->timers[idx].tccr & TCCR_TOG) != 0 &&
864             (val & TBCR_CI) == 0 &&
865             (opp->timers[idx].tbcr & TBCR_CI) != 0) {
866             opp->timers[idx].tccr &= ~TCCR_TOG;
867         }
868         opp->timers[idx].tbcr = val;
869         break;
870     case 0x20: /* TVPR */
871         write_IRQreg_ivpr(opp, opp->irq_tim0 + idx, val);
872         break;
873     case 0x30: /* TDR */
874         write_IRQreg_idr(opp, opp->irq_tim0 + idx, val);
875         break;
876     }
877 }
878 
879 static uint64_t openpic_tmr_read(void *opaque, hwaddr addr, unsigned len)
880 {
881     OpenPICState *opp = opaque;
882     uint32_t retval = -1;
883     int idx;
884 
885     DPRINTF("%s: addr %#" HWADDR_PRIx "\n", __func__, addr);
886     if (addr & 0xF) {
887         goto out;
888     }
889     idx = (addr >> 6) & 0x3;
890     if (addr == 0x0) {
891         /* TFRR */
892         retval = opp->tfrr;
893         goto out;
894     }
895     switch (addr & 0x30) {
896     case 0x00: /* TCCR */
897         retval = opp->timers[idx].tccr;
898         break;
899     case 0x10: /* TBCR */
900         retval = opp->timers[idx].tbcr;
901         break;
902     case 0x20: /* TIPV */
903         retval = read_IRQreg_ivpr(opp, opp->irq_tim0 + idx);
904         break;
905     case 0x30: /* TIDE (TIDR) */
906         retval = read_IRQreg_idr(opp, opp->irq_tim0 + idx);
907         break;
908     }
909 
910 out:
911     DPRINTF("%s: => 0x%08x\n", __func__, retval);
912 
913     return retval;
914 }
915 
916 static void openpic_src_write(void *opaque, hwaddr addr, uint64_t val,
917                               unsigned len)
918 {
919     OpenPICState *opp = opaque;
920     int idx;
921 
922     DPRINTF("%s: addr %#" HWADDR_PRIx " <= %08" PRIx64 "\n",
923             __func__, addr, val);
924 
925     addr = addr & 0xffff;
926     idx = addr >> 5;
927 
928     switch (addr & 0x1f) {
929     case 0x00:
930         write_IRQreg_ivpr(opp, idx, val);
931         break;
932     case 0x10:
933         write_IRQreg_idr(opp, idx, val);
934         break;
935     case 0x18:
936         write_IRQreg_ilr(opp, idx, val);
937         break;
938     }
939 }
940 
941 static uint64_t openpic_src_read(void *opaque, uint64_t addr, unsigned len)
942 {
943     OpenPICState *opp = opaque;
944     uint32_t retval;
945     int idx;
946 
947     DPRINTF("%s: addr %#" HWADDR_PRIx "\n", __func__, addr);
948     retval = 0xFFFFFFFF;
949 
950     addr = addr & 0xffff;
951     idx = addr >> 5;
952 
953     switch (addr & 0x1f) {
954     case 0x00:
955         retval = read_IRQreg_ivpr(opp, idx);
956         break;
957     case 0x10:
958         retval = read_IRQreg_idr(opp, idx);
959         break;
960     case 0x18:
961         retval = read_IRQreg_ilr(opp, idx);
962         break;
963     }
964 
965     DPRINTF("%s: => 0x%08x\n", __func__, retval);
966     return retval;
967 }
968 
969 static void openpic_msi_write(void *opaque, hwaddr addr, uint64_t val,
970                               unsigned size)
971 {
972     OpenPICState *opp = opaque;
973     int idx = opp->irq_msi;
974     int srs, ibs;
975 
976     DPRINTF("%s: addr %#" HWADDR_PRIx " <= 0x%08" PRIx64 "\n",
977             __func__, addr, val);
978     if (addr & 0xF) {
979         return;
980     }
981 
982     switch (addr) {
983     case MSIIR_OFFSET:
984         srs = val >> MSIIR_SRS_SHIFT;
985         idx += srs;
986         ibs = (val & MSIIR_IBS_MASK) >> MSIIR_IBS_SHIFT;
987         opp->msi[srs].msir |= 1 << ibs;
988         openpic_set_irq(opp, idx, 1);
989         break;
990     default:
991         /* most registers are read-only, thus ignored */
992         break;
993     }
994 }
995 
996 static uint64_t openpic_msi_read(void *opaque, hwaddr addr, unsigned size)
997 {
998     OpenPICState *opp = opaque;
999     uint64_t r = 0;
1000     int i, srs;
1001 
1002     DPRINTF("%s: addr %#" HWADDR_PRIx "\n", __func__, addr);
1003     if (addr & 0xF) {
1004         return -1;
1005     }
1006 
1007     srs = addr >> 4;
1008 
1009     switch (addr) {
1010     case 0x00:
1011     case 0x10:
1012     case 0x20:
1013     case 0x30:
1014     case 0x40:
1015     case 0x50:
1016     case 0x60:
1017     case 0x70: /* MSIRs */
1018         r = opp->msi[srs].msir;
1019         /* Clear on read */
1020         opp->msi[srs].msir = 0;
1021         openpic_set_irq(opp, opp->irq_msi + srs, 0);
1022         break;
1023     case 0x120: /* MSISR */
1024         for (i = 0; i < MAX_MSI; i++) {
1025             r |= (opp->msi[i].msir ? 1 : 0) << i;
1026         }
1027         break;
1028     }
1029 
1030     return r;
1031 }
1032 
1033 static uint64_t openpic_summary_read(void *opaque, hwaddr addr, unsigned size)
1034 {
1035     uint64_t r = 0;
1036 
1037     DPRINTF("%s: addr %#" HWADDR_PRIx "\n", __func__, addr);
1038 
1039     /* TODO: EISR/EIMR */
1040 
1041     return r;
1042 }
1043 
1044 static void openpic_summary_write(void *opaque, hwaddr addr, uint64_t val,
1045                                   unsigned size)
1046 {
1047     DPRINTF("%s: addr %#" HWADDR_PRIx " <= 0x%08" PRIx64 "\n",
1048             __func__, addr, val);
1049 
1050     /* TODO: EISR/EIMR */
1051 }
1052 
1053 static void openpic_cpu_write_internal(void *opaque, hwaddr addr,
1054                                        uint32_t val, int idx)
1055 {
1056     OpenPICState *opp = opaque;
1057     IRQSource *src;
1058     IRQDest *dst;
1059     int s_IRQ, n_IRQ;
1060 
1061     DPRINTF("%s: cpu %d addr %#" HWADDR_PRIx " <= 0x%08x\n", __func__, idx,
1062             addr, val);
1063 
1064     if (idx < 0) {
1065         return;
1066     }
1067 
1068     if (addr & 0xF) {
1069         return;
1070     }
1071     dst = &opp->dst[idx];
1072     addr &= 0xFF0;
1073     switch (addr) {
1074     case 0x40: /* IPIDR */
1075     case 0x50:
1076     case 0x60:
1077     case 0x70:
1078         idx = (addr - 0x40) >> 4;
1079         /* we use IDE as mask which CPUs to deliver the IPI to still. */
1080         opp->src[opp->irq_ipi0 + idx].destmask |= val;
1081         openpic_set_irq(opp, opp->irq_ipi0 + idx, 1);
1082         openpic_set_irq(opp, opp->irq_ipi0 + idx, 0);
1083         break;
1084     case 0x80: /* CTPR */
1085         dst->ctpr = val & 0x0000000F;
1086 
1087         DPRINTF("%s: set CPU %d ctpr to %d, raised %d servicing %d\n",
1088                 __func__, idx, dst->ctpr, dst->raised.priority,
1089                 dst->servicing.priority);
1090 
1091         if (dst->raised.priority <= dst->ctpr) {
1092             DPRINTF("%s: Lower OpenPIC INT output cpu %d due to ctpr\n",
1093                     __func__, idx);
1094             qemu_irq_lower(dst->irqs[OPENPIC_OUTPUT_INT]);
1095         } else if (dst->raised.priority > dst->servicing.priority) {
1096             DPRINTF("%s: Raise OpenPIC INT output cpu %d irq %d\n",
1097                     __func__, idx, dst->raised.next);
1098             qemu_irq_raise(dst->irqs[OPENPIC_OUTPUT_INT]);
1099         }
1100 
1101         break;
1102     case 0x90: /* WHOAMI */
1103         /* Read-only register */
1104         break;
1105     case 0xA0: /* IACK */
1106         /* Read-only register */
1107         break;
1108     case 0xB0: /* EOI */
1109         DPRINTF("EOI\n");
1110         s_IRQ = IRQ_get_next(opp, &dst->servicing);
1111 
1112         if (s_IRQ < 0) {
1113             DPRINTF("%s: EOI with no interrupt in service\n", __func__);
1114             break;
1115         }
1116 
1117         IRQ_resetbit(&dst->servicing, s_IRQ);
1118         /* Set up next servicing IRQ */
1119         s_IRQ = IRQ_get_next(opp, &dst->servicing);
1120         /* Check queued interrupts. */
1121         n_IRQ = IRQ_get_next(opp, &dst->raised);
1122         src = &opp->src[n_IRQ];
1123         if (n_IRQ != -1 &&
1124             (s_IRQ == -1 ||
1125              IVPR_PRIORITY(src->ivpr) > dst->servicing.priority)) {
1126             DPRINTF("Raise OpenPIC INT output cpu %d irq %d\n",
1127                     idx, n_IRQ);
1128             qemu_irq_raise(opp->dst[idx].irqs[OPENPIC_OUTPUT_INT]);
1129         }
1130         break;
1131     default:
1132         break;
1133     }
1134 }
1135 
1136 static void openpic_cpu_write(void *opaque, hwaddr addr, uint64_t val,
1137                               unsigned len)
1138 {
1139     openpic_cpu_write_internal(opaque, addr, val, (addr & 0x1f000) >> 12);
1140 }
1141 
1142 
1143 static uint32_t openpic_iack(OpenPICState *opp, IRQDest *dst, int cpu)
1144 {
1145     IRQSource *src;
1146     int retval, irq;
1147 
1148     DPRINTF("Lower OpenPIC INT output\n");
1149     qemu_irq_lower(dst->irqs[OPENPIC_OUTPUT_INT]);
1150 
1151     irq = IRQ_get_next(opp, &dst->raised);
1152     DPRINTF("IACK: irq=%d\n", irq);
1153 
1154     if (irq == -1) {
1155         /* No more interrupt pending */
1156         return opp->spve;
1157     }
1158 
1159     src = &opp->src[irq];
1160     if (!(src->ivpr & IVPR_ACTIVITY_MASK) ||
1161             !(IVPR_PRIORITY(src->ivpr) > dst->ctpr)) {
1162         fprintf(stderr, "%s: bad raised IRQ %d ctpr %d ivpr 0x%08x\n",
1163                 __func__, irq, dst->ctpr, src->ivpr);
1164         openpic_update_irq(opp, irq);
1165         retval = opp->spve;
1166     } else {
1167         /* IRQ enter servicing state */
1168         IRQ_setbit(&dst->servicing, irq);
1169         retval = IVPR_VECTOR(opp, src->ivpr);
1170     }
1171 
1172     if (!src->level) {
1173         /* edge-sensitive IRQ */
1174         src->ivpr &= ~IVPR_ACTIVITY_MASK;
1175         src->pending = 0;
1176         IRQ_resetbit(&dst->raised, irq);
1177     }
1178 
1179     if ((irq >= opp->irq_ipi0) &&  (irq < (opp->irq_ipi0 + OPENPIC_MAX_IPI))) {
1180         src->destmask &= ~(1 << cpu);
1181         if (src->destmask && !src->level) {
1182             /* trigger on CPUs that didn't know about it yet */
1183             openpic_set_irq(opp, irq, 1);
1184             openpic_set_irq(opp, irq, 0);
1185             /* if all CPUs knew about it, set active bit again */
1186             src->ivpr |= IVPR_ACTIVITY_MASK;
1187         }
1188     }
1189 
1190     return retval;
1191 }
1192 
1193 static uint32_t openpic_cpu_read_internal(void *opaque, hwaddr addr,
1194                                           int idx)
1195 {
1196     OpenPICState *opp = opaque;
1197     IRQDest *dst;
1198     uint32_t retval;
1199 
1200     DPRINTF("%s: cpu %d addr %#" HWADDR_PRIx "\n", __func__, idx, addr);
1201     retval = 0xFFFFFFFF;
1202 
1203     if (idx < 0) {
1204         return retval;
1205     }
1206 
1207     if (addr & 0xF) {
1208         return retval;
1209     }
1210     dst = &opp->dst[idx];
1211     addr &= 0xFF0;
1212     switch (addr) {
1213     case 0x80: /* CTPR */
1214         retval = dst->ctpr;
1215         break;
1216     case 0x90: /* WHOAMI */
1217         retval = idx;
1218         break;
1219     case 0xA0: /* IACK */
1220         retval = openpic_iack(opp, dst, idx);
1221         break;
1222     case 0xB0: /* EOI */
1223         retval = 0;
1224         break;
1225     default:
1226         break;
1227     }
1228     DPRINTF("%s: => 0x%08x\n", __func__, retval);
1229 
1230     return retval;
1231 }
1232 
1233 static uint64_t openpic_cpu_read(void *opaque, hwaddr addr, unsigned len)
1234 {
1235     return openpic_cpu_read_internal(opaque, addr, (addr & 0x1f000) >> 12);
1236 }
1237 
1238 static const MemoryRegionOps openpic_glb_ops_le = {
1239     .write = openpic_gbl_write,
1240     .read  = openpic_gbl_read,
1241     .endianness = DEVICE_LITTLE_ENDIAN,
1242     .impl = {
1243         .min_access_size = 4,
1244         .max_access_size = 4,
1245     },
1246 };
1247 
1248 static const MemoryRegionOps openpic_glb_ops_be = {
1249     .write = openpic_gbl_write,
1250     .read  = openpic_gbl_read,
1251     .endianness = DEVICE_BIG_ENDIAN,
1252     .impl = {
1253         .min_access_size = 4,
1254         .max_access_size = 4,
1255     },
1256 };
1257 
1258 static const MemoryRegionOps openpic_tmr_ops_le = {
1259     .write = openpic_tmr_write,
1260     .read  = openpic_tmr_read,
1261     .endianness = DEVICE_LITTLE_ENDIAN,
1262     .impl = {
1263         .min_access_size = 4,
1264         .max_access_size = 4,
1265     },
1266 };
1267 
1268 static const MemoryRegionOps openpic_tmr_ops_be = {
1269     .write = openpic_tmr_write,
1270     .read  = openpic_tmr_read,
1271     .endianness = DEVICE_BIG_ENDIAN,
1272     .impl = {
1273         .min_access_size = 4,
1274         .max_access_size = 4,
1275     },
1276 };
1277 
1278 static const MemoryRegionOps openpic_cpu_ops_le = {
1279     .write = openpic_cpu_write,
1280     .read  = openpic_cpu_read,
1281     .endianness = DEVICE_LITTLE_ENDIAN,
1282     .impl = {
1283         .min_access_size = 4,
1284         .max_access_size = 4,
1285     },
1286 };
1287 
1288 static const MemoryRegionOps openpic_cpu_ops_be = {
1289     .write = openpic_cpu_write,
1290     .read  = openpic_cpu_read,
1291     .endianness = DEVICE_BIG_ENDIAN,
1292     .impl = {
1293         .min_access_size = 4,
1294         .max_access_size = 4,
1295     },
1296 };
1297 
1298 static const MemoryRegionOps openpic_src_ops_le = {
1299     .write = openpic_src_write,
1300     .read  = openpic_src_read,
1301     .endianness = DEVICE_LITTLE_ENDIAN,
1302     .impl = {
1303         .min_access_size = 4,
1304         .max_access_size = 4,
1305     },
1306 };
1307 
1308 static const MemoryRegionOps openpic_src_ops_be = {
1309     .write = openpic_src_write,
1310     .read  = openpic_src_read,
1311     .endianness = DEVICE_BIG_ENDIAN,
1312     .impl = {
1313         .min_access_size = 4,
1314         .max_access_size = 4,
1315     },
1316 };
1317 
1318 static const MemoryRegionOps openpic_msi_ops_be = {
1319     .read = openpic_msi_read,
1320     .write = openpic_msi_write,
1321     .endianness = DEVICE_BIG_ENDIAN,
1322     .impl = {
1323         .min_access_size = 4,
1324         .max_access_size = 4,
1325     },
1326 };
1327 
1328 static const MemoryRegionOps openpic_summary_ops_be = {
1329     .read = openpic_summary_read,
1330     .write = openpic_summary_write,
1331     .endianness = DEVICE_BIG_ENDIAN,
1332     .impl = {
1333         .min_access_size = 4,
1334         .max_access_size = 4,
1335     },
1336 };
1337 
1338 static void openpic_save_IRQ_queue(QEMUFile* f, IRQQueue *q)
1339 {
1340     unsigned int i;
1341 
1342     for (i = 0; i < ARRAY_SIZE(q->queue); i++) {
1343         /* Always put the lower half of a 64-bit long first, in case we
1344          * restore on a 32-bit host.  The least significant bits correspond
1345          * to lower IRQ numbers in the bitmap.
1346          */
1347         qemu_put_be32(f, (uint32_t)q->queue[i]);
1348 #if LONG_MAX > 0x7FFFFFFF
1349         qemu_put_be32(f, (uint32_t)(q->queue[i] >> 32));
1350 #endif
1351     }
1352 
1353     qemu_put_sbe32s(f, &q->next);
1354     qemu_put_sbe32s(f, &q->priority);
1355 }
1356 
1357 static void openpic_save(QEMUFile* f, void *opaque)
1358 {
1359     OpenPICState *opp = (OpenPICState *)opaque;
1360     unsigned int i;
1361 
1362     qemu_put_be32s(f, &opp->gcr);
1363     qemu_put_be32s(f, &opp->vir);
1364     qemu_put_be32s(f, &opp->pir);
1365     qemu_put_be32s(f, &opp->spve);
1366     qemu_put_be32s(f, &opp->tfrr);
1367 
1368     qemu_put_be32s(f, &opp->nb_cpus);
1369 
1370     for (i = 0; i < opp->nb_cpus; i++) {
1371         qemu_put_sbe32s(f, &opp->dst[i].ctpr);
1372         openpic_save_IRQ_queue(f, &opp->dst[i].raised);
1373         openpic_save_IRQ_queue(f, &opp->dst[i].servicing);
1374         qemu_put_buffer(f, (uint8_t *)&opp->dst[i].outputs_active,
1375                         sizeof(opp->dst[i].outputs_active));
1376     }
1377 
1378     for (i = 0; i < OPENPIC_MAX_TMR; i++) {
1379         qemu_put_be32s(f, &opp->timers[i].tccr);
1380         qemu_put_be32s(f, &opp->timers[i].tbcr);
1381     }
1382 
1383     for (i = 0; i < opp->max_irq; i++) {
1384         qemu_put_be32s(f, &opp->src[i].ivpr);
1385         qemu_put_be32s(f, &opp->src[i].idr);
1386         qemu_get_be32s(f, &opp->src[i].destmask);
1387         qemu_put_sbe32s(f, &opp->src[i].last_cpu);
1388         qemu_put_sbe32s(f, &opp->src[i].pending);
1389     }
1390 }
1391 
1392 static void openpic_load_IRQ_queue(QEMUFile* f, IRQQueue *q)
1393 {
1394     unsigned int i;
1395 
1396     for (i = 0; i < ARRAY_SIZE(q->queue); i++) {
1397         unsigned long val;
1398 
1399         val = qemu_get_be32(f);
1400 #if LONG_MAX > 0x7FFFFFFF
1401         val <<= 32;
1402         val |= qemu_get_be32(f);
1403 #endif
1404 
1405         q->queue[i] = val;
1406     }
1407 
1408     qemu_get_sbe32s(f, &q->next);
1409     qemu_get_sbe32s(f, &q->priority);
1410 }
1411 
1412 static int openpic_load(QEMUFile* f, void *opaque, int version_id)
1413 {
1414     OpenPICState *opp = (OpenPICState *)opaque;
1415     unsigned int i, nb_cpus;
1416 
1417     if (version_id != 1) {
1418         return -EINVAL;
1419     }
1420 
1421     qemu_get_be32s(f, &opp->gcr);
1422     qemu_get_be32s(f, &opp->vir);
1423     qemu_get_be32s(f, &opp->pir);
1424     qemu_get_be32s(f, &opp->spve);
1425     qemu_get_be32s(f, &opp->tfrr);
1426 
1427     qemu_get_be32s(f, &nb_cpus);
1428     if (opp->nb_cpus != nb_cpus) {
1429         return -EINVAL;
1430     }
1431     assert(nb_cpus > 0 && nb_cpus <= MAX_CPU);
1432 
1433     for (i = 0; i < opp->nb_cpus; i++) {
1434         qemu_get_sbe32s(f, &opp->dst[i].ctpr);
1435         openpic_load_IRQ_queue(f, &opp->dst[i].raised);
1436         openpic_load_IRQ_queue(f, &opp->dst[i].servicing);
1437         qemu_get_buffer(f, (uint8_t *)&opp->dst[i].outputs_active,
1438                         sizeof(opp->dst[i].outputs_active));
1439     }
1440 
1441     for (i = 0; i < OPENPIC_MAX_TMR; i++) {
1442         qemu_get_be32s(f, &opp->timers[i].tccr);
1443         qemu_get_be32s(f, &opp->timers[i].tbcr);
1444     }
1445 
1446     for (i = 0; i < opp->max_irq; i++) {
1447         uint32_t val;
1448 
1449         val = qemu_get_be32(f);
1450         write_IRQreg_idr(opp, i, val);
1451         val = qemu_get_be32(f);
1452         write_IRQreg_ivpr(opp, i, val);
1453 
1454         qemu_get_be32s(f, &opp->src[i].ivpr);
1455         qemu_get_be32s(f, &opp->src[i].idr);
1456         qemu_get_be32s(f, &opp->src[i].destmask);
1457         qemu_get_sbe32s(f, &opp->src[i].last_cpu);
1458         qemu_get_sbe32s(f, &opp->src[i].pending);
1459     }
1460 
1461     return 0;
1462 }
1463 
1464 typedef struct MemReg {
1465     const char             *name;
1466     MemoryRegionOps const  *ops;
1467     hwaddr      start_addr;
1468     ram_addr_t              size;
1469 } MemReg;
1470 
1471 static void fsl_common_init(OpenPICState *opp)
1472 {
1473     int i;
1474     int virq = OPENPIC_MAX_SRC;
1475 
1476     opp->vid = VID_REVISION_1_2;
1477     opp->vir = VIR_GENERIC;
1478     opp->vector_mask = 0xFFFF;
1479     opp->tfrr_reset = 0;
1480     opp->ivpr_reset = IVPR_MASK_MASK;
1481     opp->idr_reset = 1 << 0;
1482     opp->max_irq = OPENPIC_MAX_IRQ;
1483 
1484     opp->irq_ipi0 = virq;
1485     virq += OPENPIC_MAX_IPI;
1486     opp->irq_tim0 = virq;
1487     virq += OPENPIC_MAX_TMR;
1488 
1489     assert(virq <= OPENPIC_MAX_IRQ);
1490 
1491     opp->irq_msi = 224;
1492 
1493     msi_supported = true;
1494     for (i = 0; i < opp->fsl->max_ext; i++) {
1495         opp->src[i].level = false;
1496     }
1497 
1498     /* Internal interrupts, including message and MSI */
1499     for (i = 16; i < OPENPIC_MAX_SRC; i++) {
1500         opp->src[i].type = IRQ_TYPE_FSLINT;
1501         opp->src[i].level = true;
1502     }
1503 
1504     /* timers and IPIs */
1505     for (i = OPENPIC_MAX_SRC; i < virq; i++) {
1506         opp->src[i].type = IRQ_TYPE_FSLSPECIAL;
1507         opp->src[i].level = false;
1508     }
1509 }
1510 
1511 static void map_list(OpenPICState *opp, const MemReg *list, int *count)
1512 {
1513     while (list->name) {
1514         assert(*count < ARRAY_SIZE(opp->sub_io_mem));
1515 
1516         memory_region_init_io(&opp->sub_io_mem[*count], OBJECT(opp), list->ops,
1517                               opp, list->name, list->size);
1518 
1519         memory_region_add_subregion(&opp->mem, list->start_addr,
1520                                     &opp->sub_io_mem[*count]);
1521 
1522         (*count)++;
1523         list++;
1524     }
1525 }
1526 
1527 static void openpic_init(Object *obj)
1528 {
1529     OpenPICState *opp = OPENPIC(obj);
1530 
1531     memory_region_init(&opp->mem, obj, "openpic", 0x40000);
1532 }
1533 
1534 static void openpic_realize(DeviceState *dev, Error **errp)
1535 {
1536     SysBusDevice *d = SYS_BUS_DEVICE(dev);
1537     OpenPICState *opp = OPENPIC(dev);
1538     int i, j;
1539     int list_count = 0;
1540     static const MemReg list_le[] = {
1541         {"glb", &openpic_glb_ops_le,
1542                 OPENPIC_GLB_REG_START, OPENPIC_GLB_REG_SIZE},
1543         {"tmr", &openpic_tmr_ops_le,
1544                 OPENPIC_TMR_REG_START, OPENPIC_TMR_REG_SIZE},
1545         {"src", &openpic_src_ops_le,
1546                 OPENPIC_SRC_REG_START, OPENPIC_SRC_REG_SIZE},
1547         {"cpu", &openpic_cpu_ops_le,
1548                 OPENPIC_CPU_REG_START, OPENPIC_CPU_REG_SIZE},
1549         {NULL}
1550     };
1551     static const MemReg list_be[] = {
1552         {"glb", &openpic_glb_ops_be,
1553                 OPENPIC_GLB_REG_START, OPENPIC_GLB_REG_SIZE},
1554         {"tmr", &openpic_tmr_ops_be,
1555                 OPENPIC_TMR_REG_START, OPENPIC_TMR_REG_SIZE},
1556         {"src", &openpic_src_ops_be,
1557                 OPENPIC_SRC_REG_START, OPENPIC_SRC_REG_SIZE},
1558         {"cpu", &openpic_cpu_ops_be,
1559                 OPENPIC_CPU_REG_START, OPENPIC_CPU_REG_SIZE},
1560         {NULL}
1561     };
1562     static const MemReg list_fsl[] = {
1563         {"msi", &openpic_msi_ops_be,
1564                 OPENPIC_MSI_REG_START, OPENPIC_MSI_REG_SIZE},
1565         {"summary", &openpic_summary_ops_be,
1566                 OPENPIC_SUMMARY_REG_START, OPENPIC_SUMMARY_REG_SIZE},
1567         {NULL}
1568     };
1569 
1570     if (opp->nb_cpus > MAX_CPU) {
1571         error_set(errp, QERR_PROPERTY_VALUE_OUT_OF_RANGE,
1572                   TYPE_OPENPIC, "nb_cpus", (uint64_t)opp->nb_cpus,
1573                   (uint64_t)0, (uint64_t)MAX_CPU);
1574         return;
1575     }
1576 
1577     switch (opp->model) {
1578     case OPENPIC_MODEL_FSL_MPIC_20:
1579     default:
1580         opp->fsl = &fsl_mpic_20;
1581         opp->brr1 = 0x00400200;
1582         opp->flags |= OPENPIC_FLAG_IDR_CRIT;
1583         opp->nb_irqs = 80;
1584         opp->mpic_mode_mask = GCR_MODE_MIXED;
1585 
1586         fsl_common_init(opp);
1587         map_list(opp, list_be, &list_count);
1588         map_list(opp, list_fsl, &list_count);
1589 
1590         break;
1591 
1592     case OPENPIC_MODEL_FSL_MPIC_42:
1593         opp->fsl = &fsl_mpic_42;
1594         opp->brr1 = 0x00400402;
1595         opp->flags |= OPENPIC_FLAG_ILR;
1596         opp->nb_irqs = 196;
1597         opp->mpic_mode_mask = GCR_MODE_PROXY;
1598 
1599         fsl_common_init(opp);
1600         map_list(opp, list_be, &list_count);
1601         map_list(opp, list_fsl, &list_count);
1602 
1603         break;
1604 
1605     case OPENPIC_MODEL_RAVEN:
1606         opp->nb_irqs = RAVEN_MAX_EXT;
1607         opp->vid = VID_REVISION_1_3;
1608         opp->vir = VIR_GENERIC;
1609         opp->vector_mask = 0xFF;
1610         opp->tfrr_reset = 4160000;
1611         opp->ivpr_reset = IVPR_MASK_MASK | IVPR_MODE_MASK;
1612         opp->idr_reset = 0;
1613         opp->max_irq = RAVEN_MAX_IRQ;
1614         opp->irq_ipi0 = RAVEN_IPI_IRQ;
1615         opp->irq_tim0 = RAVEN_TMR_IRQ;
1616         opp->brr1 = -1;
1617         opp->mpic_mode_mask = GCR_MODE_MIXED;
1618 
1619         if (opp->nb_cpus != 1) {
1620             error_setg(errp, "Only UP supported today");
1621             return;
1622         }
1623 
1624         map_list(opp, list_le, &list_count);
1625         break;
1626     }
1627 
1628     for (i = 0; i < opp->nb_cpus; i++) {
1629         opp->dst[i].irqs = g_new(qemu_irq, OPENPIC_OUTPUT_NB);
1630         for (j = 0; j < OPENPIC_OUTPUT_NB; j++) {
1631             sysbus_init_irq(d, &opp->dst[i].irqs[j]);
1632         }
1633     }
1634 
1635     register_savevm(dev, "openpic", 0, 2,
1636                     openpic_save, openpic_load, opp);
1637 
1638     sysbus_init_mmio(d, &opp->mem);
1639     qdev_init_gpio_in(dev, openpic_set_irq, opp->max_irq);
1640 }
1641 
1642 static Property openpic_properties[] = {
1643     DEFINE_PROP_UINT32("model", OpenPICState, model, OPENPIC_MODEL_FSL_MPIC_20),
1644     DEFINE_PROP_UINT32("nb_cpus", OpenPICState, nb_cpus, 1),
1645     DEFINE_PROP_END_OF_LIST(),
1646 };
1647 
1648 static void openpic_class_init(ObjectClass *oc, void *data)
1649 {
1650     DeviceClass *dc = DEVICE_CLASS(oc);
1651 
1652     dc->realize = openpic_realize;
1653     dc->props = openpic_properties;
1654     dc->reset = openpic_reset;
1655 }
1656 
1657 static const TypeInfo openpic_info = {
1658     .name          = TYPE_OPENPIC,
1659     .parent        = TYPE_SYS_BUS_DEVICE,
1660     .instance_size = sizeof(OpenPICState),
1661     .instance_init = openpic_init,
1662     .class_init    = openpic_class_init,
1663 };
1664 
1665 static void openpic_register_types(void)
1666 {
1667     type_register_static(&openpic_info);
1668 }
1669 
1670 type_init(openpic_register_types)
1671